Index: src/server.js
===================================================================
--- src/server.js	(revision 5b1115b90b55bebe00c4653e305b3037061f614b)
+++ src/server.js	(revision 931b4cb4516d24601a74d0f9d9297a1bd3467044)
@@ -149,4 +149,14 @@
 if (!isDev) app.set('trust proxy', 1);
 
+// Collapse leading duplicate slashes in the path. A reverse proxy that proxies with
+// `RewriteRule ^(.*)$ http://localhost:3000/$1` (Apache [P]) sends "//" for the root and
+// "//path" for sub-paths (the captured $1 keeps its leading slash) → Express matches no
+// route → the whole site 404'd behind such a proxy. Normalising here makes Klonkt resilient
+// to that common reverse-proxy setup. (Only the leading slashes; the query string is intact.)
+app.use((req, res, next) => {
+  if (req.url.startsWith('//')) req.url = req.url.replace(/^\/+/, '/');
+  next();
+});
+
 // Create/migrate the schema BEFORE anything touches the DB: the session store
 // queries the `sessions` table on construction, so on a fresh install the tables